3 from socket import inet_pton, inet_ntop, AF_INET, AF_INET6
6 from framework import VppTestCase, VppTestRunner
7 from vpp_ip import DpoProto
8 from vpp_ip_route import VppIpRoute, VppRoutePath, VppMplsLabel, VppIpTable
10 from scapy.packet import Raw
11 from scapy.layers.l2 import Ether
12 from scapy.layers.inet import IP, UDP
13 from scapy.layers.inet6 import IPv6
15 from vpp_object import VppObject
20 def find_abf_policy(test, id):
21 policies = test.vapi.abf_policy_dump()
23 if id == p.policy.policy_id:
28 def find_abf_itf_attach(test, id, sw_if_index):
29 attachs = test.vapi.abf_itf_attach_dump()
31 if id == a.attach.policy_id and \
32 sw_if_index == a.attach.sw_if_index:
37 class VppAbfPolicy(VppObject):
45 self.policy_id = policy_id
49 def encode_paths(self):
54 if type(l) == VppMplsLabel:
55 lstack.append(l.encode())
57 lstack.append({'label': l, 'ttl': 255})
58 n_labels = len(lstack)
59 while (len(lstack) < 16):
61 br_paths.append({'next_hop': p.nh_addr,
64 'sw_if_index': 0xffffffff,
66 'table_id': p.nh_table_id,
67 'next_hop_id': p.next_hop_id,
68 'is_udp_encap': p.is_udp_encap,
70 'label_stack': lstack})
73 def add_vpp_config(self):
74 self._test.vapi.abf_policy_add_del(
76 {'policy_id': self.policy_id,
77 'acl_index': self.acl.acl_index,
78 'n_paths': len(self.paths),
79 'paths': self.encode_paths()})
80 self._test.registry.register(self, self._test.logger)
82 def remove_vpp_config(self):
83 self._test.vapi.abf_policy_add_del(
85 {'policy_id': self.policy_id,
86 'acl_index': self.acl.acl_index,
87 'n_paths': len(self.paths),
88 'paths': self.encode_paths()})
90 def query_vpp_config(self):
91 return find_abf_policy(self._test, self.policy_id)
94 return ("abf-policy-%d" % self.policy_id)
97 class VppAbfAttach(VppObject):
106 self.policy_id = policy_id
107 self.sw_if_index = sw_if_index
108 self.priority = priority
109 self.is_ipv6 = is_ipv6
111 def add_vpp_config(self):
112 self._test.vapi.abf_itf_attach_add_del(
114 {'policy_id': self.policy_id,
115 'sw_if_index': self.sw_if_index,
116 'priority': self.priority,
117 'is_ipv6': self.is_ipv6})
118 self._test.registry.register(self, self._test.logger)
120 def remove_vpp_config(self):
121 self._test.vapi.abf_itf_attach_add_del(
123 {'policy_id': self.policy_id,
124 'sw_if_index': self.sw_if_index,
125 'priority': self.priority,
126 'is_ipv6': self.is_ipv6})
128 def query_vpp_config(self):
129 return find_abf_itf_attach(self._test,
134 return ("abf-attach-%d-%d" % (self.policy_id, self.sw_if_index))
137 class TestAbf(VppTestCase):
138 """ ABF Test Case """
142 super(TestAbf, cls).setUpClass()
145 def tearDownClass(cls):
146 super(TestAbf, cls).tearDownClass()
149 super(TestAbf, self).setUp()
151 self.create_pg_interfaces(range(5))
153 for i in self.pg_interfaces[:4]:
161 for i in self.pg_interfaces:
166 super(TestAbf, self).tearDown()
169 """ IPv4 ACL Based Forwarding
173 # We are not testing the various matching capabilities
174 # of ACLs, that's done elsewhere. Here ware are testing
175 # the application of ACLs to a forwarding path to achieve
177 # So we construct just a few ACLs to ensure the ABF policies
178 # are correctly constructed and used. And a few path types
179 # to test the API path decoding.
185 rule_1 = ({'is_permit': 1,
188 'srcport_or_icmptype_first': 1234,
189 'srcport_or_icmptype_last': 1234,
190 'src_ip_prefix_len': 32,
191 'src_ip_addr': inet_pton(AF_INET, "1.1.1.1"),
192 'dstport_or_icmpcode_first': 1234,
193 'dstport_or_icmpcode_last': 1234,
194 'dst_ip_prefix_len': 32,
195 'dst_ip_addr': inet_pton(AF_INET, "1.1.1.2")})
196 acl_1 = self.vapi.acl_add_replace(acl_index=4294967295, r=[rule_1])
199 # ABF policy for ACL 1 - path via interface 1
201 abf_1 = VppAbfPolicy(self, 10, acl_1,
202 [VppRoutePath(self.pg1.remote_ip4,
203 self.pg1.sw_if_index)])
204 abf_1.add_vpp_config()
207 # Attach the policy to input interface Pg0
209 attach_1 = VppAbfAttach(self, 10, self.pg0.sw_if_index, 50)
210 attach_1.add_vpp_config()
213 # fire in packet matching the ACL src,dst. If it's forwarded
214 # then the ABF was successful, since default routing will drop it
216 p_1 = (Ether(src=self.pg0.remote_mac,
217 dst=self.pg0.local_mac) /
218 IP(src="1.1.1.1", dst="1.1.1.2") /
219 UDP(sport=1234, dport=1234) /
221 self.send_and_expect(self.pg0, p_1*NUM_PKTS, self.pg1)
224 # Attach a 'better' priority policy to the same interface
226 abf_2 = VppAbfPolicy(self, 11, acl_1,
227 [VppRoutePath(self.pg2.remote_ip4,
228 self.pg2.sw_if_index)])
229 abf_2.add_vpp_config()
230 attach_2 = VppAbfAttach(self, 11, self.pg0.sw_if_index, 40)
231 attach_2.add_vpp_config()
233 self.send_and_expect(self.pg0, p_1*NUM_PKTS, self.pg2)
236 # Attach a policy with priority in the middle
238 abf_3 = VppAbfPolicy(self, 12, acl_1,
239 [VppRoutePath(self.pg3.remote_ip4,
240 self.pg3.sw_if_index)])
241 abf_3.add_vpp_config()
242 attach_3 = VppAbfAttach(self, 12, self.pg0.sw_if_index, 45)
243 attach_3.add_vpp_config()
245 self.send_and_expect(self.pg0, p_1*NUM_PKTS, self.pg2)
248 # remove the best priority
250 attach_2.remove_vpp_config()
251 self.send_and_expect(self.pg0, p_1*NUM_PKTS, self.pg3)
254 # Attach one of the same policies to Pg1
256 attach_4 = VppAbfAttach(self, 12, self.pg1.sw_if_index, 45)
257 attach_4.add_vpp_config()
259 p_2 = (Ether(src=self.pg1.remote_mac,
260 dst=self.pg1.local_mac) /
261 IP(src="1.1.1.1", dst="1.1.1.2") /
262 UDP(sport=1234, dport=1234) /
264 self.send_and_expect(self.pg1, p_2 * NUM_PKTS, self.pg3)
267 # detach the policy from PG1, now expect traffic to be dropped
269 attach_4.remove_vpp_config()
271 self.send_and_assert_no_replies(self.pg1, p_2 * NUM_PKTS, "Detached")
274 # Swap to route via a next-hop in the non-default table
276 table_20 = VppIpTable(self, 20)
277 table_20.add_vpp_config()
279 self.pg4.set_table_ip4(table_20.table_id)
281 self.pg4.config_ip4()
282 self.pg4.resolve_arp()
284 abf_13 = VppAbfPolicy(self, 13, acl_1,
285 [VppRoutePath(self.pg4.remote_ip4,
287 nh_table_id=table_20.table_id)])
288 abf_13.add_vpp_config()
289 attach_5 = VppAbfAttach(self, 13, self.pg0.sw_if_index, 30)
290 attach_5.add_vpp_config()
292 self.send_and_expect(self.pg0, p_1*NUM_PKTS, self.pg4)
294 self.pg4.unconfig_ip4()
295 self.pg4.set_table_ip4(0)
298 """ IPv6 ACL Based Forwarding
302 # Simple test for matching IPv6 packets
308 rule_1 = ({'is_permit': 1,
311 'srcport_or_icmptype_first': 1234,
312 'srcport_or_icmptype_last': 1234,
313 'src_ip_prefix_len': 128,
314 'src_ip_addr': inet_pton(AF_INET6, "2001::2"),
315 'dstport_or_icmpcode_first': 1234,
316 'dstport_or_icmpcode_last': 1234,
317 'dst_ip_prefix_len': 128,
318 'dst_ip_addr': inet_pton(AF_INET6, "2001::1")})
319 acl_1 = self.vapi.acl_add_replace(acl_index=4294967295,
323 # ABF policy for ACL 1 - path via interface 1
325 abf_1 = VppAbfPolicy(self, 10, acl_1,
326 [VppRoutePath("3001::1",
328 proto=DpoProto.DPO_PROTO_IP6)])
329 abf_1.add_vpp_config()
331 attach_1 = VppAbfAttach(self, 10, self.pg0.sw_if_index,
333 attach_1.add_vpp_config()
336 # a packet matching the rule
338 p = (Ether(src=self.pg0.remote_mac,
339 dst=self.pg0.local_mac) /
340 IPv6(src="2001::2", dst="2001::1") /
341 UDP(sport=1234, dport=1234) /
345 # packets are dropped because there is no route to the policy's
348 self.send_and_assert_no_replies(self.pg1, p * NUM_PKTS, "no route")
351 # add a route resolving the next-hop
353 route = VppIpRoute(self, "3001::1", 32,
354 [VppRoutePath(self.pg1.remote_ip6,
355 self.pg1.sw_if_index,
356 proto=DpoProto.DPO_PROTO_IP6)],
358 route.add_vpp_config()
361 # now expect packets forwarded.
363 self.send_and_expect(self.pg0, p * NUM_PKTS, self.pg1)
366 if __name__ == '__main__':
367 unittest.main(testRunner=VppTestRunner)